ECS Network Service inputs: ECS cluster to logging

Type: rvn-ecs-nlb / Latest version: 2.3.2 See ECS Network Service module reference for the full module page.

ECS cluster

$ref:rvn-ecs-cluster

required

Cluster.

Immutable after creation

Set cluster to null. Mapped inputs for cluster: set these keys alongside cluster, not inside it, when supplying existing infrastructure instead of a module reference.

string

AWS account.

Default: <<ref.input.aws_account_id>>
Immutable after creation

string

Region.

Default: <<ref.input.aws_region>>
Immutable after creation

string

Terraform execution environment. Terraform execution environment inherited from the selected ECS cluster.

Default: << ref.input.execution_environment_id >>

string

required

Cluster ARN.

Default: <<ref.stack.output.cluster_arn>>
Immutable after creation

number

Cluster default log retention (days). Default CloudWatch Logs retention inherited from the selected ECS cluster. Override it per service in the Compliance section.

Default: <<ref.stack.output.log_retention_days>>

string

required

VPC ID.

Default: <<ref.input.vpc_id>>
Immutable after creation

string_array

required

Private subnet IDs. Private subnets available from the selected ECS cluster network.

Default: <<ref.input.private_subnet_ids>>
Immutable after creation

string_array

Public subnet IDs. Public subnets available from the selected ECS cluster network.

Default: <<ref.input.public_subnet_ids>>
Immutable after creation

string_array

Private subnet IDs. Legacy service subnet override. Leave blank to derive subnets from the public/private service setting.

Default: <<ref.input.private_subnet_ids>>
Immutable after creation

section

Cluster capacity providers.

string

Fargate capacity provider.

Default: <<ref.stack.output.fargate_capacity_provider_name>>
Immutable after creation

string

Fargate spot capacity provider.

Default: <<ref.stack.output.fargate_spot_capacity_provider_name>>
Immutable after creation

string

EC2 capacity provider. EC2 capacity provider name from the selected cluster.

Default: <<ref.stack.output.ec2_capacity_provider_name>>
Immutable after creation

section

Cluster network load balancers.

string

Public NLB ARN.

Default: <<ref.stack.output.public_nlb_arn>>
Immutable after creation

string

Public NLB ARN suffix.

Default: <<ref.stack.output.public_nlb_arn_suffix>>
Immutable after creation

string

Public NLB security group ID.

Default: <<ref.stack.output.public_nlb_security_group_id>>
Immutable after creation

string

Private NLB ARN.

Default: <<ref.stack.output.private_nlb_arn>>
Immutable after creation

string

Private NLB ARN suffix.

Default: <<ref.stack.output.private_nlb_arn_suffix>>
Immutable after creation

string

Private NLB security group ID.

Default: <<ref.stack.output.private_nlb_security_group_id>>
Immutable after creation

Network service

string

required

Service name. Name for the ECS service and related resources.

Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
Immutable after creation
Pattern: ^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$ — Use 1-255 letters, numbers, underscores, or hyphens, starting with a letter or number.

boolean

Public network service. Expose this service through the public NLB. Turn off to use the private NLB.

Default: true

boolean

Run in private subnets. Recommended. Requires a NAT gateway or equivalent for internet access and keeps tasks off public subnets.

Default: true

Build config

string

required

Build source.

Default: dockerfile
Allowed values: dockerfile (Dockerfile), railpack (Railpack), image_registry (Pull from image registry), ecr (Managed ECR repository)

gitrepo

required

Git repository. Repository containing the application source for Dockerfile or Railpack builds.

Shown when: {"build_source":["dockerfile","railpack"]}

string

Source base path. Repository-relative source and build root.

Default: .
Shown when: {"build_source":["dockerfile","railpack"]}

string

required

Image repository. Image repository without a tag or digest, such as nginx, ghcr.io/org/app, or 123456789012.dkr.ecr.us-east-1.amazonaws.com/app.

Shown when: {"build_source":"image_registry"}

string

Registry credentials secret ARN. Secrets Manager secret ARN for private registries such as GHCR or Docker Hub. The secret must use the ECS repository credentials JSON format. Not needed for public images or normal same-account ECR.

Shown when: {"build_source":"image_registry"}

string_array

Start command. Optional command arguments that override the image default command. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

Default: []
Shown when: {"build_source":["image_registry","ecr"]}

Docker

string

Dockerfile path. Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.

Shown when: {"build_source":"dockerfile"}

string

Docker build context path. Directory to use as the Docker build context, relative to the repository root or configured source base path.

Shown when: {"build_source":"dockerfile"}

Railpack

string

Railpack version. Optional Railpack version to use for the build. Leave blank to use the Ravion default.

Pattern: ^(|latest|v?[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)$ — Leave blank, use latest, a semantic version like 0.29.0, or a v-prefixed version like v0.29.0.
Shown when: {"build_source":"railpack"}

string

Install command. Optional dependency installation command. Leave blank to use Railpack detection.

Shown when: {"build_source":"railpack"}

string

Build command. Optional application build command. Leave blank to use Railpack detection.

Shown when: {"build_source":"railpack"}

string

Start command.

Shown when: {"build_source":"railpack"}

Network listeners

object_array

required

Listeners. One to five NLB listeners and the unique container port each listener targets.

Default: [{"container_port":3000,"listener_port":80,"listener_protocol":"TCP"}]
Immutable after creation

Show item fields

number

required

Listener port. Port the NLB listens on. Each listener port must be unique.

Default: 80
Min: 1
Max: 65535

string

required

Listener protocol. Protocol accepted by this NLB listener.

Default: TCP
Allowed values: TCP, TLS, UDP

number

required

Container port. Port the container listens on. Each listener must use a unique container port.

Default: 3000
Min: 1
Max: 65535

$ref:rvn-acm-certificate

required

TLS certificate. ACM certificate module for this TLS listener.

Shown when: {"listener_protocol":"TLS"}

Set tls_certificate to null. Mapped inputs for tls_certificate: set these keys alongside tls_certificate, not inside it, when supplying existing infrastructure instead of a module reference.

string

TLS certificate ARN.

Default: <<ref.stack.output.certificate_arn>>

string

TLS SSL policy. SSL policy for this TLS listener.

Default: ELBSecurityPolicy-TLS13-1-2-2021-06
Shown when: {"listener_protocol":"TLS"}

string

TLS ALPN policy. Optional ALPN policy for this TLS listener.

Default: None
Allowed values: HTTP1Only (HTTP1 only), HTTP2Only (HTTP2 only), HTTP2Optional (HTTP2 optional), HTTP2Preferred (HTTP2 preferred), None
Shown when: {"listener_protocol":"TLS"}

string

required

TLS target protocol. Protocol used between the NLB and the ECS task. Use TCP for TLS termination at the NLB or TLS for encrypted traffic to the task.

Default: TCP
Allowed values: TCP, TLS
Shown when: {"listener_protocol":"TLS"}

string_array

NLB ingress CIDRs. IPv4 CIDR blocks allowed to reach the NLB listener.

Default: ["0.0.0.0/0"]
Shown when: {"public_nlb_service_enabled":true}

string_array

Private NLB ingress CIDRs. IPv4 CIDR blocks allowed to reach the private NLB listener.

Default: ["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]
Shown when: {"public_nlb_service_enabled":false}

Health check

string

required

Health check protocol. Protocol the target group uses for health checks.

Default: TCP
Allowed values: TCP, HTTP, HTTPS

string

required

Health check path. HTTP path the load balancer calls to verify the service is healthy.

Default: /
Shown when: {"health_check_protocol":["HTTP","HTTPS"]}

string

required

Success codes. HTTP status code matcher for successful health checks.

Default: 200-399
Shown when: {"health_check_protocol":["HTTP","HTTPS"]}

number

Interval (secs). Seconds between load balancer health checks.

Default: 30
Min: 5
Max: 300

number

Timeout (secs). Seconds to wait for the health-check response before marking that check as failed.

Default: 10
Min: 2
Max: 120

number

Healthy threshold. Number of consecutive successful checks required before an unhealthy target is considered healthy.

Default: 3
Min: 2
Max: 10

number

Unhealthy threshold. Number of consecutive failed checks required before a target is considered unhealthy.

Default: 3
Min: 2
Max: 10

number

Health check grace period (secs). Seconds ECS ignores failing load balancer health checks after a task starts.

Default: 0
Min: 0

number

Deregistration delay (secs). Seconds the target group waits for in-flight requests to drain before deregistering a target.

Default: 300
Min: 0
Max: 3600

boolean

Source IP stickiness. Keep repeat traffic from the same source IP on the same task when possible.

Default: false

Container resources

string

required

Capacity provider. Choose the primary capacity provider. Most services should use only one provider.

Default: fargate
Allowed values: fargate (Fargate), fargate_spot (Fargate spot), ec2 (EC2)

boolean

Also use Fargate. Add Fargate to the capacity provider strategy in addition to the primary provider.

Default: false
Shown when: {"capacity_provider":{"not":"fargate"}}

boolean

Also use Fargate spot. Add lower-cost interruptible Fargate spot capacity in addition to the primary provider.

Default: false
Shown when: {"capacity_provider":{"not":"fargate_spot"}}

boolean

Also use EC2. Add EC2 capacity from the selected cluster in addition to the primary provider.

Default: false
Shown when: {"capacity_provider":{"not":"ec2"}}

compound

required

App size. CPU and memory for Fargate tasks. Prices are estimated from AWS Fargate pricing for the selected region, architecture, and capacity provider.

Default: {"memory_gb":4,"vcpu":2}
Shown when: {"capacity_provider":["fargate","fargate_spot"]}

number

App ephemeral storage (GiB). Optional ephemeral storage size for each Fargate app task, from 21 to 200 GiB. Leave blank to use the AWS default of 20 GiB.

Min: 21
Max: 200
Shown when: {"capacity_provider":["fargate","fargate_spot"]}

string

required

App vCPU. vCPU reserved for each app task on EC2 capacity. Leave at least 0.25 vCPU unreserved on each EC2 instance for the ECS agent and system processes.

Default: 1.5
Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a vCPU value, such as 0.5, 1, or 2.
Shown when: {"capacity_provider":"ec2"}

string

required

App memory in GB. Memory reserved for each app task on EC2 capacity. Leave at least 0.5 GB unreserved on each EC2 instance for the ECS agent and system processes.

Default: 3.5
Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a memory value in GB, such as 0.5, 1, or 4.
Shown when: {"capacity_provider":"ec2"}

string

CPU architecture. Use x86_64 for broad compatibility; use ARM64 for lower cost when your image and dependencies support it.

Default: X86_64
Allowed values: X86_64 (x86_64 - widest compatibility), ARM64 (ARM64 - lower cost)

boolean

ECS exec. Enable ECS Exec for interactive debugging in running containers. Leave off by default for tighter access control; turn on when operators need shell/debug access through AWS Systems Manager.

Default: false

Autoscaling

boolean

Autoscaling.

Default: true

number

Minimum tasks. Recommend at least 2 for production.

Default: 1
Min: 0
Shown when: {"auto_scaling_enabled":true}

number

Maximum tasks.

Default: 3
Min: 1
Shown when: {"auto_scaling_enabled":true}

number

Desired tasks. Number of tasks to keep running when autoscaling is disabled.

Default: 1
Min: 1
Shown when: {"auto_scaling_enabled":false}

number

CPU target (%).

Default: 70
Min: 1
Max: 100
Shown when: {"auto_scaling_enabled":true}

number

Memory target (%). Target average memory utilization for memory-based autoscaling. Leave blank to disable memory autoscaling.

Default: 80
Min: 1
Max: 100
Shown when: {"auto_scaling_enabled":true}

number

Scale-in cooldown (secs). Time after a scale-in activity before another scale-in can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

Default: 300
Min: 0
Shown when: {"auto_scaling_enabled":true}

number

Scale-out cooldown (secs). Time after a scale-out activity before another scale-out can happen. AWS defaults ECS target tracking cooldowns to 300 secs; start here for production and tune if needed.

Default: 300
Min: 0
Shown when: {"auto_scaling_enabled":true}

boolean

Scale in. Allow autoscaling to reduce task count automatically.

Default: true
Shown when: {"auto_scaling_enabled":true}

object_array

Scheduled scaling actions. Optional Application Auto Scaling scheduled actions for the ECS service desired tasks. Each action sets a recurring, one-time, or rate-based schedule and may update the minimum tasks, maximum tasks, or both.

Default: []
Shown when: {"auto_scaling_enabled":true}

Show item fields

string

required

Action name. Unique scheduled action name for this ECS service scalable target. AWS allows 1-256 characters and rejects leading/trailing spaces, control characters, colon, slash, and pipe.

Pattern: ^(?! )(?!.* $)(?!.*[\x00-\x1F\x7F-\x9F:/|]).{1,256}$ — Use 1-256 characters with no leading/trailing spaces and no control characters, colon, slash, or pipe.

string

required

Schedule expression. Application Auto Scaling schedule expression: at(yyyy-mm-ddThh:mm:ss), rate(value unit), or cron(fields). Cron normally uses six fields: minutes, hours, day-of-month, month, day-of-week, year.

Pattern: ^(at$.+$|rate$[1-9][0-9]* (minute|minutes|hour|hours|day|days)$|cron$.+$)$ — Use at(…), rate(value minute|minutes|hour|hours|day|days), or cron(…).

number

Minimum tasks. Optional desired-task floor to apply when this action runs. Set minimum tasks, maximum tasks, or both.

Min: 0

number

Maximum tasks. Optional desired-task ceiling to apply when this action runs. Set maximum tasks, minimum tasks, or both.

Min: 0

string

Time zone. IANA/Joda-Time canonical time zone used for at() and cron() expressions. Defaults to UTC. Does not affect start_time or end_time.

Default: UTC
Pattern: ^[A-Za-z_+-]+(?:/[A-Za-z0-9_+.-]+)*$ — Use a canonical IANA/Joda-Time time zone such as UTC, America/New_York, Etc/GMT+9, or Pacific/Tahiti.

string

Start time. Optional UTC boundary for when a recurring scheduled action starts. Terraform expects RFC 3339 format and this value is not affected by timezone.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$ — Use UTC RFC 3339 format, for example 2026-01-02T15:04:05Z.

string

End time. Optional UTC boundary for when a recurring scheduled action stops. Terraform expects RFC 3339 format and this value is not affected by timezone.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$ — Use UTC RFC 3339 format, for example 2026-01-02T23:04:05Z.

object_array

Custom metric scaling policies. Additional target tracking scaling policies using custom CloudWatch metrics. Each policy must use a metric that changes proportionally with ECS service capacity.

Default: []
Shown when: {"auto_scaling_enabled":true}

Show item fields

string

required

Policy name. Application Auto Scaling policy name. Terraform/AWS require 1-255 characters and this name must be unique for the scalable target. The names cpu, memory, and request_count are used by the built-in policies.

Pattern: ^.{1,255}$ — Use 1-255 characters.

number

required

Target value. Target value for the custom metric. Choose a value appropriate for the CloudWatch metric, such as desired average queue depth per task.

object

required

Custom metric. CloudWatch customized metric specification supported by this Terraform module: metric_name, namespace, statistic, and optional dimensions map. Statistic must be Average, Minimum, Maximum, SampleCount, or Sum.

Default: {"dimensions":{}}

number

Scale-in cooldown seconds. Seconds after a scale-in activity completes before another scale-in activity can start.

Default: 300
Min: 0

number

Scale-out cooldown seconds. Seconds to wait for a previous scale-out activity to take effect.

Default: 300
Min: 0

boolean

Scale in. Allow this target tracking policy to remove running tasks automatically.

Default: true

Environment variables

object

Build environment variables. Only available during the build, not at runtime. Use environment variables or secrets for runtime values.

boolean

Inject environment variables in Dockerfile. Pass build environment variables into Dockerfile builds as build arguments.

Default: false
Shown when: {"build_source":"dockerfile"}

array

Runtime environment variables. Runtime environment variables passed to the app container. PORT is added automatically from the container port setting.

array

Runtime secrets. Secrets injected into the ECS task at runtime, as an array of objects with name and value_from keys (snake_case, not valueFrom). value_from is an SSM Parameter Store or Secrets Manager ARN.

Pre and post deploy

boolean

Run pre-deploy command. Run a one-off ECS task before updating the ECS service.

Default: false

string_array

required

Pre-deploy command. Command arguments to run before updating the ECS service. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

Default: []
Shown when: {"pre_deploy_enabled":true}

array

Pre-deploy environment variables. Additional environment variables for the pre-deploy task. Runtime environment variables and secrets are already inherited from the app container.

Default: []
Shown when: {"pre_deploy_enabled":true}

string

Pre-deploy CPU. Optional CPU for the pre-deploy task, where 1 is one vCPU. Leave blank to use the app task CPU.

Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a CPU value in vCPU, such as 0.5, 1, or 2.
Shown when: {"pre_deploy_enabled":true}

string

Pre-deploy memory. Optional memory for the pre-deploy task, where 1 is 1 GB. Leave blank to use the app task memory.

Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a memory value in GB, such as 0.5, 1, or 4.
Shown when: {"pre_deploy_enabled":true}

number

Pre-deploy ephemeral storage (GiB). Optional ephemeral storage size for the pre-deploy task. Leave blank to use the task definition default.

Min: 21
Max: 200
Shown when: {"pre_deploy_enabled":true}

number

Pre-deploy timeout (secs). Maximum time to wait for the pre-deploy task to finish.

Default: 1800
Min: 1
Shown when: {"pre_deploy_enabled":true}

boolean

Run post-deploy command. Run a one-off ECS task after the ECS service deployment succeeds.

Default: false

string_array

required

Post-deploy command. Command arguments to run after the ECS service deployment succeeds. For shell behavior, use /bin/sh, -lc, and your command string as separate arguments.

Default: []
Shown when: {"post_deploy_enabled":true}

array

Post-deploy environment variables. Additional environment variables for the post-deploy task. Runtime environment variables and secrets are already inherited from the app container.

Default: []
Shown when: {"post_deploy_enabled":true}

string

Post-deploy CPU. Optional CPU for the post-deploy task, where 1 is one vCPU. Leave blank to use the app task CPU.

Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a CPU value in vCPU, such as 0.5, 1, or 2.
Shown when: {"post_deploy_enabled":true}

string

Post-deploy memory. Optional memory for the post-deploy task, where 1 is 1 GB. Leave blank to use the app task memory.

Pattern: ^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$ — Enter a memory value in GB, such as 0.5, 1, or 4.
Shown when: {"post_deploy_enabled":true}

number

Post-deploy ephemeral storage (GiB). Optional ephemeral storage size for the post-deploy task. Leave blank to use the task definition default.

Min: 21
Max: 200
Shown when: {"post_deploy_enabled":true}

number

Post-deploy timeout (secs). Maximum time to wait for the post-deploy task to finish.

Default: 1800
Min: 1
Shown when: {"post_deploy_enabled":true}

number

Healthy tasks required for success (%). Percentage of desired tasks that must be running and healthy on the new revision. Must be at least Minimum healthy percent. ECS still requires one healthy task on nonzero services at 0%. Deployment rollback monitoring ends at success; remaining tasks scale in the background.

Default: 100
Min: << module.input.deployment_minimum_healthy_percent >>
Max: 100

boolean

Wait for old tasks to drain. Choose whether old tasks must finish draining before deployment success. Alarm bake time still applies in both modes.

Default: false

Logging

boolean

FireLens log routing. Routes the app container logs through a Fluent Bit sidecar. CloudWatch output stays enabled by default so Ravion runtime logs continue to work.

Default: false

string

required

FireLens image. Container image for the Fluent Bit log router sidecar.

Default: public.ecr.aws/aws-observability/aws-for-fluent-bit:stable
Shown when: {"firelens_enabled":true}

text

Additional Fluent Bit config. Optional Fluent Bit config appended after the generated [SERVICE] block. Add [OUTPUT] blocks here for destinations such as Datadog, Splunk, Firehose, OpenSearch, or S3.

Shown when: {"firelens_enabled":true}

boolean

Keep CloudWatch output enabled. Recommended. Sends FireLens-routed app logs to the service CloudWatch log group so Ravion runtime logs continue to work. Disable only if all app logs should go exclusively to external destinations.

Default: true
Shown when: {"firelens_enabled":true}

boolean

Add ECS log metadata. Adds ECS cluster, task, and container metadata to FireLens log records.

Default: true
Shown when: {"firelens_enabled":true}

array

FireLens environment variables. Environment variables passed to the log router sidecar. Use these for non-secret destination options.

Default: []
Shown when: {"firelens_enabled":true}

array

FireLens secrets. Secrets injected into the log router sidecar, as an array of objects with name and value_from keys (snake_case, not valueFrom). Use these for API keys or tokens stored in SSM Parameter Store or Secrets Manager.

Default: []
Shown when: {"firelens_enabled":true}

Introduction

Concepts

Config as code

Migrate

Modules

Pipelines

GitHub Actions

Guides

Troubleshooting

Agent setup

Module definitions

ECS Network Service inputs: ECS cluster to logging

ECS cluster

Network service

Build config

Docker

Railpack

Network listeners

Health check

Container resources

Autoscaling

Environment variables

Pre and post deploy

Logging

​ECS cluster

​Network service

​Build config

​Docker

​Railpack

​Network listeners

​Health check

​Container resources

​Autoscaling

​Environment variables

​Pre and post deploy

​Logging

ECS cluster

Network service

Build config

Docker

Railpack

Network listeners

Health check

Container resources

Autoscaling

Environment variables

Pre and post deploy

Logging